Reproduce Bug
Use when a named runtime or compiler bug in a local repository needs independent...
Install
npx skills add trailofbits/skills --skill reproduce-bug -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Engineering
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Lightabout 690 tokens
- Runs scripts
- No, instructions only
What it does
Use when a named runtime or compiler bug in a local repository needs independent reproduction.
Reproduce Bug
When to Use
Use for the reproduction step of patching-bugs with one finding.json and a local
baseline checkout. Read the record contract.
Before target commands, follow its project guidance.
When NOT to Use
Do not use for bug discovery, patching, or a claim that cannot be exercised locally. Report a blocker when the build or environment cannot exercise the claim.
Procedure
- Select
failure_typefrom the record contract. Build the current baseline with the project's own command. Exercise the planned scoped inputs before any edit and retain their observations, including valid controls. Save raw stdout, stderr, exit status, and timing. If the behavior is absent with trustworthy evidence, reportnot_reproduced; if setup or observations are unreliable, reportblocked. - Runtime: exercise the built
target_artifactwith a PoC that recordsPATCH_LOADEDas defined in the contract, then printsPATCH_REACHEDimmediately before the assertion. Exit nonzero for the bug, zero otherwise; a setup crash is inconclusive. Compile: record the targetexpected_diagnosticfrom the failed compiler invocation; use emptypoc_argvand nulltarget_artifact. - Save any unchanged PoC source under
reproduce/poc/and raw receipts underreproduce/receipts/. Writereproduce.jsonwith the baseline commit, command argument arrays, artifact path, observed result, outcome, and your agent identity. Setfinding.statustoreproducedornot_reproducedfrom the result. If reproduction isblocked, leavefinding.statusashypothesis.
